Anthropic Warns AI Models Could Soon Self-Replicate on Smart TVs and IoT Devices Without a Data Center
By Guru Baran
Anthropic warns that small AI models may be months away from self-replicating across poorly secured smart TVs and other internet-connected devices.
Its research suggests future AI worms could run on consumer hardware rather than depend on a data center, making them harder to shut down through a single central service.
According to research published on October 12 by William Zhou and Daniel Freeman, AI agents may be able to install and run models on unfamiliar machines.
Researchers stressed that they have not demonstrated a complete rogue replicator. Their findings show progress toward that threat, not an active AI malware outbreak.
Anthropic Warns AI Could Self-Replicate Across IoT Devices
Researchers ran Gemma4-26B-A4B across 15 off-brand Android TV boxes costing about $55 each. Every box had 4GB of RAM and stored part of the model. Together, the devices achieved 0.39 tokens per second, showing that cheap hardware can support a large model, although very slowly.
This approach uses distributed inference, where several machines share the work of running an AI model. Instead of fitting everything into one device, researchers split its layers across the boxes.
A future worm could carry model weights, the files containing its learned values, onto compromised devices and use their combined resources. The proposed replication chain involves finding targets, gaining access, setting up inference, and spreading from newly reached hosts.
Anthropic focused mainly on inference setup, which requires choosing suitable software, fixing package issues, and handling different operating systems. A nine-billion-parameter model successfully established inference on eight of nine hardware types tested.
.webp)
AI Exploitation Workflow Overview (Image Source: Anthropic)
In a separate experiment, researchers used eight Google Cloud machines running Android emulators inside an isolated network. Their Android Debug Bridge ports required no authentication.
GLM-5.2 reached all eight machines in four of five trials and seven machines in the remaining trial while establishing Llama3.1-8B inference. However, the agent’s own model ran on a separate inference server. Researchers spawned new agent copies after checking each successful setup.
This was therefore a simplified test of replication skills, not proof that GLM-5.2 could independently live and reproduce on TV boxes. The easy access path also limits real-world conclusions.
Network Node Replication Graph (Image Source: Anthropic)
Anthropic estimates smaller models could reach the required skill level by late 2026 if past improvement rates continue. That forecast uses a general AI capability measure rather than a direct replication measure.
Hardware limits would still slow spread, with estimated Qwen3.5-9B inference setup taking roughly 28 to 51 hours.
Small Model Capability Timeline (Image Source: Anthropic)
Existing infections show why this matters. The Kimwolf botnet compromised more than two million devices, including many Android TV boxes.
Unlike fixed malware, future AI worms might adjust their setup methods for unfamiliar systems and pass useful troubleshooting notes to later copies. Defenders should watch for large model downloads, unusual traffic between devices, network scanning, and unexpected outbound connections.
The Kimwolf v7 report also recommends disabling exposed ADB access and separating TV boxes from business networks. Stronger device security and coordinated isolation of infected hosts could reduce opportunities for AI worms to spread.
